opencode-wait-a-minute 0.0.0-stage → 1.1.0-rc.10

package/src/execution/execution-engine.js

@@ -0,0 +1,258 @@
+/**
+ * Autonomous execution loop — hypothesis → classify → experiment → observe → replan.
+ * Non-destructive: never hard-deletes. Failed approaches are archived/rejected.
+ *
+ * Decoupled into:
+ *   - observation-engine.js — raw observation recording
+ *   - evidence-engine.js    — evidence creation + lineage linking
+ *   - state-machine.js      — hypothesis / experiment status transitions
+ *
+ * This module orchestrates the three engines and remains the entry point
+ * for startExperiment / noteFailure / noteSuccess / handleContradiction.
+ */
+
+import {
+  createHypothesis,
+  createExperiment,
+  completeExperiment,
+  failExperiment,
+  updateHypothesisStatus,
+  hasRepetitiveFailure,
+  archiveHypothesis,
+  HYPOTHESIS_STATUS,
+} from "../cognition/cognition-store.js";
+import { guardAction } from "./runtime-guards.js";
+import { rejectHypothesis } from "../cognition/cognitive-state.js";
+import { assessObservation, AssessmentResult } from "../policy/assessment-engine.js";
+import { noteContradiction } from "../cognition/hypothesis-manager.js";
+import { getTaskState, persistTaskState } from "../skills/engine.js";
+
+// Re-exported as public API surface of the execution entry point.
+export { assessObservation };
+
+import {
+  recordRawObservation,
+  resolveExperimentContext,
+} from "../cognition/observation-engine.js";
+import {
+  produceExecutionEvidence,
+  linkEvidenceIfBound,
+} from "../evidence/evidence-engine.js";
+import {
+  deriveHypothesisStatus,
+  shouldReplan,
+  shouldNoteContradiction,
+} from "../state/state-machine.js";
+
+function describe(tool, args = {}) {
+  const { hypothesisId: _h, ...rest } = args;
+  return `${tool}:${JSON.stringify(rest)}`;
+}
+
+/**
+ * Resolve the requirement an execution outcome belongs to. Prefers the
+ * explicit id supplied by the runtime bridge; falls back to the task's
+ * active requirement (first not done/verified) so a success observation
+ * still propagates to the lifecycle state it satisfies.
+ */
+function resolveRequirementId(taskRoot, taskId, requirementId) {
+  if (requirementId) return requirementId;
+  const state = getTaskState(taskId, taskRoot);
+  const requirements = Array.isArray(state?.requirements) ? state.requirements : [];
+  const active =
+    requirements.find((r) => r.status !== "done" && r.status !== "verified") ||
+    requirements[0] ||
+    null;
+  return active?.id || null;
+}
+
+/**
+ * Propagate a SUPPORTED execution outcome to the requirement lifecycle:
+ * mark it verified and attach the producing evidence id. This is the seam
+ * where the cognition store (evidence) meets the task state (requirement
+ * status); without it a successful tool leaves the completion gate blocked.
+ */
+function markRequirementVerified(taskRoot, taskId, requirementId, evidenceId) {
+  if (!requirementId) return false;
+  const state = getTaskState(taskId, taskRoot);
+  if (!state || !Array.isArray(state.requirements)) return false;
+  const requirement = state.requirements.find((r) => r.id === requirementId);
+  if (!requirement) return false;
+  requirement.status = "verified";
+  if (evidenceId) {
+    if (!Array.isArray(requirement.evidence)) requirement.evidence = [];
+    if (!requirement.evidence.includes(evidenceId)) requirement.evidence.push(evidenceId);
+  }
+  requirement.verifiedAt = requirement.verifiedAt || Date.now();
+  persistTaskState(taskId, state, taskRoot);
+  return true;
+}
+
+/**
+ * Pure orchestrator: turn an observation + assessment into the next
+ * hypothesis status and the persisted observation record. Delegates
+ * persistence to observation-engine and status derivation to state-machine.
+ */
+function processObservation(taskRoot, taskId, args) {
+  // Resolve experiment context first so the assessment has the right input shape
+  // (it needs experiment.expectedObservation to compare against args.actual).
+  const experiment = resolveExperimentContext(taskRoot, taskId, args);
+  const assessment = assessObservation(experiment ?? { id: null }, {
+    actual: args.actual,
+    unexpected: args.unexpected,
+    provenance: args.provenance,
+    experimentId: args.experimentId,
+  });
+  // Now persist with the *assessment* result, not the raw tool result.
+  const { observation } = recordRawObservation(taskRoot, taskId, {
+    ...args,
+    result: assessment.result,
+  });
+  const { status, severity } = deriveHypothesisStatus(assessment);
+  updateHypothesisStatus(taskRoot, taskId, args.hypothesisId, status);
+
+  return { assessment, hypothesisStatus: status, severity, observation };
+}
+
+export async function startExperiment(taskRoot, taskId, { statement, tool, args = {}, confidence = 0.5, expectedObservation }) {
+  const hypothesis = createHypothesis(taskRoot, taskId, { statement, confidence });
+  const input = { ...args, hypothesisId: hypothesis.id };
+  const guard = await guardAction(tool, input, taskRoot, taskId);
+  if (!guard.allowed) {
+    archiveHypothesis(taskRoot, taskId, hypothesis.id, guard.reason || "blocked by policy");
+    return { ok: false, hypothesis, guard };
+  }
+
+  const actionDescription = describe(tool, args);
+  if (hasRepetitiveFailure(taskRoot, taskId, { hypothesisId: hypothesis.id, actionDescription })) {
+    archiveHypothesis(taskRoot, taskId, hypothesis.id, "repetitive failure");
+    return { ok: false, hypothesis, guard: { allowed: false, reason: "repetitive failure" } };
+  }
+
+  const experiment = createExperiment(taskRoot, taskId, {
+    hypothesisId: hypothesis.id,
+    tool,
+    args,
+    actionDescription,
+    expectedObservation,
+  });
+  updateHypothesisStatus(taskRoot, taskId, hypothesis.id, HYPOTHESIS_STATUS.TESTING);
+  return { ok: true, hypothesis, experiment, guard };
+}
+
+export function noteFailure(taskRoot, taskId, { hypothesisId, experimentId, reason, actual, unexpected, provenance }) {
+  if (experimentId) failExperiment(taskRoot, taskId, experimentId, reason);
+  const { assessment, hypothesisStatus, severity } = processObservation(taskRoot, taskId, {
+    hypothesisId,
+    experimentId,
+    reason,
+    actual,
+    unexpected,
+    provenance,
+    outcome: "failure",
+  });
+  // Explicit failure: if the assessment didn't already drive the hypothesis to
+  // a terminal state (SUPPORTED), archive it so callers observing the cognition
+  // store see REJECTED/ARCHIVED instead of stale TESTING. This preserves
+  // noteSuccess semantics (no forced archive on success outcomes).
+  // Preserve terminal decisions: REJECTED is already the outcome of a
+  // high-severity contradiction (state-machine derive). Only soft-archive
+  // non-terminal states (e.g. TESTING) so callers never observe stale
+  // TESTING. Archiving REJECTED on top of itself erased the distinction
+  // between "contradicted" and "retired".
+  if (
+    hypothesisStatus !== HYPOTHESIS_STATUS.SUPPORTED &&
+    hypothesisStatus !== HYPOTHESIS_STATUS.REJECTED
+  ) {
+    archiveHypothesis(taskRoot, taskId, hypothesisId, reason || "failure");
+  }
+  return {
+    assessment,
+    hypothesisStatus,
+    severity,
+    replan: shouldReplan({ assessment, hypothesisStatus }),
+  };
+}
+
+export function noteSuccess(taskRoot, taskId, { hypothesisId, experimentId, result, actual, unexpected, provenance, requirementId }) {
+  // 0. Mark the experiment as COMPLETED (mirrors noteFailure → failExperiment).
+  if (experimentId) completeExperiment(taskRoot, taskId, experimentId, { result });
+
+  // Bind the outcome to a requirement even when the caller omits it, so the
+  // evidence lineage and the task lifecycle stay connected.
+  const effectiveRequirementId = resolveRequirementId(taskRoot, taskId, requirementId);
+
+  // 1. Create evidence first so we can carry its id into the observation facts.
+  const { evidence } = produceExecutionEvidence(taskId, taskRoot, {
+    requirementId: effectiveRequirementId,
+    result,
+    hypothesisId,
+  });
+
+  // 2. Persist observation with the evidence id as the primary fact.
+  const { assessment, hypothesisStatus, observation } = processObservation(taskRoot, taskId, {
+    hypothesisId,
+    experimentId,
+    result,
+    actual,
+    unexpected,
+    provenance,
+    outcome: "success",
+    facts: [evidence.id],
+  });
+
+  // 3. Bind evidence to the requirement lineage when both sides are known.
+  linkEvidenceIfBound({
+    evidenceId: evidence.id,
+    requirementId: effectiveRequirementId,
+    hypothesisId,
+    experimentId,
+    observationId: observation?.id,
+    taskId,
+    taskRoot,
+  });
+
+  // A supported outcome verifies the requirement it satisfies: this closes the
+  // seam between cognition evidence and task-state verification.
+  if (assessment.result === AssessmentResult.SUPPORTED) {
+    markRequirementVerified(taskRoot, taskId, effectiveRequirementId, evidence?.id);
+  }
+
+  if (assessment.result === AssessmentResult.CONTRADICTED) {
+    if (shouldNoteContradiction({ assessment, hypothesisStatus })) {
+      noteContradiction(taskId, hypothesisId, observation, assessment, taskRoot);
+    }
+    return {
+      assessment,
+      hypothesisStatus,
+      severity: null,
+      replan: shouldReplan({ assessment, hypothesisStatus }),
+    };
+  }
+  return { assessment, hypothesisStatus };
+}
+
+export function handleContradiction(taskRoot, taskId, { experiment, observation, assessment }) {
+  const { hypothesisId, id: experimentId } = experiment;
+  updateHypothesisStatus(taskRoot, taskId, hypothesisId, "contradicted");
+  rejectHypothesis(taskRoot, hypothesisId, "contradicted by observation");
+  const contradiction = noteContradiction(taskId, hypothesisId, observation, assessment, taskRoot);
+  recordRawObservation(taskRoot, taskId, {
+    experimentId,
+    hypothesisId,
+    result: assessment.result,
+    facts: [contradiction.detail],
+    provenance: { type: "execution-assessment" },
+  });
+  const newHypothesis = createHypothesis(taskRoot, taskId, {
+    statement: `[REPLAN] New hypothesis after contradicting ${hypothesisId}: reassess strategy`,
+    confidence: 0.3,
+  });
+  return {
+    status: "CONTRADICTED",
+    previousHypothesisId: hypothesisId,
+    previousExperimentId: experimentId,
+    assessment,
+    newHypothesis,
+  };
+}

package/src/execution/execution-intent.js

@@ -0,0 +1,69 @@
+export const EXECUTION_INTENT = Object.freeze({
+  DIRECT_REQUIREMENT_ACTION: "DIRECT_REQUIREMENT_ACTION",
+  SUPPORTING_ACTION: "SUPPORTING_ACTION",
+  INVESTIGATION: "INVESTIGATION",
+  VALIDATION: "VALIDATION",
+  RECOVERY: "RECOVERY",
+  UNKNOWN: "UNKNOWN",
+});
+
+const INVESTIGATION_TOOLS = new Set(["read", "read_file", "list_directory", "list_files", "get_file", "glob", "grep", "search", "webfetch", "fetch", "task_search", "tool_search"]);
+const RECOVERY_TOOLS = new Set(["revert", "rollback", "restore"]);
+const VALIDATION_TOOLS = new Set(["test", "spec", "vitest", "jest", "pytest", "mocha"]);
+const MODIFICATION_TOOLS = new Set(["write", "edit", "apply_patch", "patch", "todo_write", "todowrite"]);
+
+export function classifyExecutionIntent(tool, args = {}, statement = "") {
+  const operation = String(tool || "").toLowerCase();
+  const stmt = String(statement || "").toLowerCase();
+  const cmd = String(args?.command || "").toLowerCase();
+  const first = (cmd.split(/\s+/)[0] || "");
+
+  if (RECOVERY_TOOLS.has(operation)) return EXECUTION_INTENT.RECOVERY;
+
+  if (VALIDATION_TOOLS.has(operation) || /\b(test|spec|verify|check|assert)\b/.test(operation) || /\btest\b/.test(cmd)) {
+    return EXECUTION_INTENT.VALIDATION;
+  }
+
+  if (INVESTIGATION_TOOLS.has(operation)) return EXECUTION_INTENT.INVESTIGATION;
+  if (/^(ls|find|cat|grep|search|inspect|inspect_file|view|show)/.test(cmd.split(/\s+/)[0] || "")) return EXECUTION_INTENT.INVESTIGATION;
+
+  if (MODIFICATION_TOOLS.has(operation)) {
+    return EXECUTION_INTENT.SUPPORTING_ACTION;
+  }
+
+  if (/^(npm|pnpm|yarn|brew|apt|pip)\s+(install|add|setup|i)\b/.test(cmd) || /^(install|setup|setup_)/.test(cmd.split(/\s+/)[0] || "")) {
+    return EXECUTION_INTENT.SUPPORTING_ACTION;
+  }
+
+  if (/^(npm|pnpm|yarn|node|deno|ruby|python|bash|sh|make|cargo|go|docker|kubectl|npx)/.test(first)) {
+    if (/^npx\s+/.test(cmd) || /\binstall\b/.test(cmd) || /\bsetup\b/.test(cmd)) {
+      return EXECUTION_INTENT.SUPPORTING_ACTION;
+    }
+    if (/\btest\b/.test(cmd)) {
+      return EXECUTION_INTENT.VALIDATION;
+    }
+    if (/\b(run|exec|start|build)\b/.test(cmd)) {
+      return EXECUTION_INTENT.DIRECT_REQUIREMENT_ACTION;
+    }
+    return EXECUTION_INTENT.SUPPORTING_ACTION;
+  }
+
+  if (stmt && /\brequirement\b/.test(stmt) && !/(install|setup|test|spec)/.test(cmd)) {
+    if (operation && MODIFICATION_TOOLS.has(operation)) {
+      return EXECUTION_INTENT.DIRECT_REQUIREMENT_ACTION;
+    }
+  }
+
+  return EXECUTION_INTENT.UNKNOWN;
+}
+
+export function isDirectRequirementAction(intent) {
+  return intent === EXECUTION_INTENT.DIRECT_REQUIREMENT_ACTION;
+}
+
+export function isSupportingAction(intent) {
+  return intent === EXECUTION_INTENT.SUPPORTING_ACTION ||
+    intent === EXECUTION_INTENT.INVESTIGATION ||
+    intent === EXECUTION_INTENT.VALIDATION ||
+    intent === EXECUTION_INTENT.RECOVERY;
+}

package/src/execution/execution-state.js

@@ -0,0 +1,89 @@
+/**
+ * Formal execution state — single source of truth for task lifecycle.
+ * Implements spec: formal-execution-state.
+ *
+ * States:
+ *   INITIALIZING | INVESTIGATING | EXECUTING | VERIFYING | COMPLETED
+ *   BLOCKED | WAITING_AUTHORIZATION | FAILED
+ *
+ * Transition table is strict: only documented transitions are allowed.
+ */
+
+const VALID_STATES = new Set([
+  "INITIALIZING",
+  "INVESTIGATING",
+  "EXECUTING",
+  "VERIFYING",
+  "COMPLETED",
+  "BLOCKED",
+  "WAITING_AUTHORIZATION",
+  "FAILED",
+]);
+
+const ALLOWED_TRANSITIONS = {
+  INITIALIZING: new Set(["INVESTIGATING", "BLOCKED"]),
+  INVESTIGATING: new Set(["EXECUTING", "WAITING_AUTHORIZATION", "BLOCKED"]),
+  EXECUTING: new Set(["VERIFYING", "BLOCKED", "FAILED"]),
+  VERIFYING: new Set(["COMPLETED", "EXECUTING", "FAILED"]),
+  WAITING_AUTHORIZATION: new Set(["EXECUTING", "BLOCKED"]),
+  BLOCKED: new Set(["INVESTIGATING", "EXECUTING"]),
+  FAILED: new Set(["INVESTIGATING"]),
+  COMPLETED: new Set(),
+};
+
+const LEGACY_PHASE_TO_STATE = {
+  ASKING: "WAITING_AUTHORIZATION",
+  PROPOSED: "INVESTIGATING",
+  IMPLEMENTING: "EXECUTING",
+  VERIFYING: "VERIFYING",
+  DONE: "COMPLETED",
+};
+
+export function isValidState(s) {
+  return typeof s === "string" && VALID_STATES.has(s);
+}
+
+export function migrateLegacyPhase(phase) {
+  return LEGACY_PHASE_TO_STATE[phase] || "INITIALIZING";
+}
+
+export function validateState(s) {
+  if (!isValidState(s)) {
+    throw new Error(`Invalid execution state: ${JSON.stringify(s)}. Must be one of: ${[...VALID_STATES].join(", ")}`);
+  }
+}
+
+import { hasOutstandingWork } from "../verification/verification-lifecycle.js";
+
+export function transition(from, to, taskState = null) {
+  validateState(from);
+  validateState(to);
+  // Guard: block transition to COMPLETED if there is outstanding work
+  if (to === "COMPLETED" && hasOutstandingWork(taskState)) {
+    throw new Error("Cannot transition to COMPLETED while there is outstanding work (unverified requirements or pending backlog)");
+  }
+  const allowed = ALLOWED_TRANSITIONS[from];
+  if (!allowed.has(to)) {
+    throw new Error(`Invalid transition: ${from} → ${to}. Allowed from ${from}: ${[...allowed].join(", ") || "(none, terminal)"}`);
+  }
+  return to;
+}
+
+export function getStatusReport(taskState, { experiments = [], failures = [], pendingAuth = null, verification = null, completionEvidence = [] } = {}) {
+  if (!taskState) return "Sin estado de tarea";
+  const lines = [
+    `state: ${taskState.state || migrateLegacyPhase(taskState.phase)}`,
+    `strategy: ${taskState.approvedStrategy?.strategy || "—"}`,
+    `current hypothesis: ${taskState.currentHypothesis || "—"}`,
+    `experiments: ${experiments.length}`,
+    `failures: ${failures.length}`,
+    `pending authorization: ${pendingAuth ? pendingAuth.id || pendingAuth.question || "yes" : "none"}`,
+    `verification status: ${verification?.status || "pending"}`,
+    `completion evidence: ${completionEvidence.length} item(s)`,
+  ];
+  // Add each piece of completion evidence with req id and evidence
+  for (const item of completionEvidence) {
+    lines.push(`${item.req}: ${item.evidence}`);
+  }
+  return lines.join("\n");
+}

package/src/execution/formatting.js

@@ -0,0 +1,60 @@
+/**
+ * Formatting — funciones puras de formateo y presentación.
+ *
+ * Contiene:
+ *   - truncate: utilidad de truncamiento de texto (compartida)
+ *   - delegationLines: formatea lines de delegación para el inyector
+ *   - getStatusReport: formatea reporte de estado (re-exportado)
+ *
+ * Todas son PURAS: toman datos como entrada, retornan strings/arrays.
+ * Sin side effects (no persisten, no leen, no escriben).
+ */
+
+import { getStatusReport } from "./execution-state.js";
+
+export { getStatusReport } from "./execution-state.js";
+
+// -- Shared utility --------------------------------------------------------
+
+/**
+ * Trunca texto a máximo `max` caracteres con "..." al final.
+ */
+export function truncate(text, max = 80) {
+  if (!text || text.length <= max) return text || "";
+  return text.slice(0, max - 3) + "...";
+}
+
+// -- Delegation lines -------------------------------------------------------
+
+const MAX_VISIBLE_REQS = 8;
+
+/**
+ * Formatea las líneas de delegación visible para el inyector de sistema.
+ * Solo se muestra when contract está APPROVED con requisitos pendientes.
+ *
+ * @param {Object} state - Estado de la tarea
+ * @param {Function} [domainHintFn] - Función opcional para clasificar dominio (ej: domainHint de index.js)
+ * @returns {string[]} Líneas de delegación
+ */
+export function delegationLines(state, domainHintFn = null) {
+  const reqs = state?.contract?.requirements || [];
+  if (!reqs.length) return [];
+  if (state?.contract?.status !== "APPROVED") return [];
+
+  const pending = reqs.filter((r) => r.status !== "done" && r.status !== "verified");
+  if (!pending.length) return [];
+
+  const lines = [
+    "⏳ Delegación: estos requerimientos están aprobados para ejecución paralela:",
+  ];
+  const visible = pending.slice(0, MAX_VISIBLE_REQS);
+  const overflow = pending.length - MAX_VISIBLE_REQS;
+  for (const r of visible) {
+    const hint = domainHintFn ? domainHintFn(r.title) : "";
+    lines.push(`  ${r.id} → Task(parallel) "${truncate(r.title, 120)}"${hint ? ` [contexto: ${hint}]` : ""}`);
+  }
+  if (overflow > 0) {
+    lines.push(`  ...(+${overflow} requerimientos adicionales consolidados)`);
+  }
+  return lines;
+}

package/src/execution/l1-sanitize.js

@@ -0,0 +1,16 @@
+import path from "node:path";
+
+export function sanitizeShellArg(arg) {
+  // Simple shell escaping
+  return "'" + arg.replace(/'/g, "'\\''") + "'";
+}
+
+export function sanitizePath(unsafePath) {
+  // Resolve and verify base to prevent traversal
+  const resolvedPath = path.resolve(unsafePath);
+  return resolvedPath;
+}
+
+export function stripControlChars(str) {
+  return str.replace(/[\x00-\x1F\x7F]/g, "");
+}

package/src/execution/l2-resource-guards.js

@@ -0,0 +1,19 @@
+export class ResourceGuard {
+  constructor(options = {}) {
+    this.maxDuration = options.maxDuration || 5000;
+  }
+
+  async runWithTimeout(task) {
+    const controller = new AbortController();
+    const timeout = setTimeout(() => controller.abort(), this.maxDuration);
+
+    try {
+      return await Promise.race([
+        task(controller.signal),
+        new Promise((_, reject) => controller.signal.addEventListener('abort', () => reject(new Error("AbortError"))))
+      ]);
+    } finally {
+      clearTimeout(timeout);
+    }
+  }
+}

package/src/execution/l3-invariant-checker.js

@@ -0,0 +1,5 @@
+export function checkStateInvariant(state, invariant) {
+  if (!invariant(state)) {
+    throw new Error("Invariant violation detected");
+  }
+}

package/src/execution/l4-containment.js

@@ -0,0 +1,6 @@
+import vm from "node:vm";
+
+export function runInSandbox(code, context = {}) {
+  const sandbox = vm.createContext({ ...context });
+  return vm.runInContext(code, sandbox);
+}

package/src/execution/runtime-guards.js

@@ -0,0 +1,106 @@
+import { findRepeatedExperiment, hasRepetitiveFailure } from "../cognition/cognition-store.js";
+import { evaluateAction } from "../policy/risk-engine.js";
+import { getCapability, CAPABILITY_LEVELS } from "../policy/action-capabilities.js";
+
+const HARD_DELETE_RE =
+  /\b(rmdir|unlink|shred|truncate)\b|\brm\s+(-[a-zA-Z]*f|--force)|\bgit\s+reset\s+--hard\b|\b(DROP|TRUNCATE)\s+(TABLE|DATABASE)\b/i;
+
+const HARD_DELETE_TOOLS = new Set(["rm", "rmdir"]);
+
+function isHardDelete(tool, args = {}) {
+  const t = String(tool || "").toLowerCase();
+  if (HARD_DELETE_TOOLS.has(t)) return true;
+  const cmd = String(args.command || args.cmd || "");
+  return HARD_DELETE_RE.test(cmd);
+}
+
+function actionDescription(tool, args = {}) {
+  const { hypothesisId: _h, ...rest } = args;
+  return `${tool}:${JSON.stringify(rest)}`;
+}
+
+/**
+ * Autonomy Runtime Guards
+ *
+ * Intercepta ejecución para evaluar:
+ * 1. Riesgo de la acción (Risk Envelope)
+ * 2. Stagnation/Repetition (cognition-store)
+ * 3. Hard-delete ban (U1: soft-archive only)
+ * 4. Scope enforcement
+ */
+export async function guardAction(tool, args, taskRoot, taskId) {
+  // 0. Fail-closed (C01): herramientas no catalogadas se bloquean aquí,
+  //    ANTES de cualquier otra evaluación. Esto crea una segunda línea
+  //    de defensa independiente del risk-engine: aunque la evaluación
+  //    contextual cambie, una herramienta desconocida nunca llega a
+  //    ejecutarse.
+  const capability = getCapability(tool);
+  if (capability === CAPABILITY_LEVELS.UNKNOWN) {
+    return {
+      allowed: false,
+      level: "BLOCKED",
+      reason: `fail-closed: herramienta no catalogada (${tool})`,
+    };
+  }
+
+  if (isHardDelete(tool, args)) {
+    return {
+      allowed: false,
+      level: "BLOCKED",
+      reason: "hard delete forbidden (U1: soft-archive only)",
+    };
+  }
+
+  let risk;
+  try {
+    risk = evaluateAction(tool, args, taskRoot);
+  } catch (err) {
+    const name = err?.name || err?.constructor?.name;
+    if (name === "WamPolicyBlock") {
+      return { allowed: false, level: "BLOCKED", reason: err.message };
+    }
+    throw err;
+  }
+
+  if (risk.level === "BLOCKED") {
+    return {
+      allowed: false,
+      level: "BLOCKED",
+      reason: risk.reason || "destructive or irreversible action blocked",
+    };
+  }
+
+  const desc = actionDescription(tool, args);
+  const probe = {
+    hypothesisId: args?.hypothesisId || "unknown",
+    actionDescription: desc,
+  };
+
+  if (hasRepetitiveFailure(taskRoot, taskId, probe)) {
+    return {
+      allowed: false,
+      level: risk.level,
+      reason: "repetitive failure: same hypothesis+action already failed. Replan with a new hypothesis.",
+    };
+  }
+
+  const repeated = findRepeatedExperiment(taskRoot, taskId, probe);
+
+  if (risk.level === "GUARDED" && !args?.hypothesisId) {
+    return {
+      allowed: true,
+      level: risk.level,
+      warning: "GUARDED action without hypothesisId — attach hypothesis before mutating.",
+    };
+  }
+
+  if (repeated) {
+    return {
+      allowed: true,
+      level: risk.level,
+      warning: `Repetición detectada: ya se intentó ${repeated.status}. Considera replanificar.`,
+    };
+  }
+
+  return { allowed: true, level: risk.level };
+}